Creating a cross account IAM Lambda role using CDK

user_856498 0
Viewed 3398

In my scenario I have 2 accounts (11111111, 22222222) that need to+ invoke a lambda in a 3rd account: 33333333. The lambdas in the 3rd account will be invoked from lambdas in the first 2.

The lambdas in 3rd account are created on the fly but I need to give them a role which I wish to create using CDK (which I will do using 3rd account creds - no cross account stuff here).

I am following the instructions here - invoking the lambda using STS seems straightforward. What I am not fully clear on is how to define the 3rd account role in cdk.

Here's my stack:


export class ModuleIAMStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props)

    const lambdaModuleRole = new Role(this, 'moduleRole', {
      roleName: 'moduleRole',
      assumedBy: new AccountPrincipal({ accountId: '111111111' }),
      managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')] // My lambdas in 3X... will not need to access any resources so this should be enough to execute
    })
  }
}

I am unclear on the assumedBy line. Is AccountPrincipal the correct entry? and if so how do I enter the 22222222 account?

aws-cdk amazon-web-services
1 Answers

AccountPrincipal will generate a principal like this: arn:aws:iam::123456789012:root. This is enough to allow the whole account.

And as for the CDK - you are almost there:

assumedBy: new iam.CompositePrincipal(
    new iam.AccountPrincipal('111111111'),
    new iam.AccountPrincipal('22222222')
),
user_47379240
Related